Skip to content
Free Diagnostics Bundle

Free Kubernetes Resource Audit Bundle

Collect resource, workload, and namespace signals locally, or describe the problem first and receive a bounded Initial Assessment Report that recommends the most useful evidence and next step.

Get a Free Assessment Download Release

Running the collector does not send data to TacitSoft. Generated raw inventory stays local and customer-confidential. The free-assessment form accepts only your problem statement; it does not accept bundle uploads.

How it works

  1. 1 Download the public collector and review what it does.
  2. 2 Run locally against your cluster context and inspect the generated files.
  3. 3 Assess the next step by describing the problem. TacitSoft will identify useful evidence without requiring an upload.

What it collects

  • Cluster and namespace resource inventory.
  • Exact Kubernetes, k3s, runtime, node OS, kernel, and kubelet versions.
  • Warning events, best-effort k3s certificate status, and filtered security-relevant kubelet warnings.
  • Workload requests, limits, replicas, and scheduling metadata.
  • PodScheduled conditions, container waiting states, and namespace events.
  • PVC, PV, StorageClass, service, ingress, and configuration references.
  • Deployment, StatefulSet, DaemonSet, Job, and ReplicaSet owner chains.
  • Privileged execution, host access, container security context, and service-account metadata.
  • Pod Security Admission, NetworkPolicy, RBAC, service exposure, and ingress TLS metadata.
  • Pod and controller image references, resolved digests, and pull failures.
  • Optional normalized local Syft, Grype, Trivy, and version results.
  • Service, ingress, storage, and configuration references.
  • Optional node and per-container usage samples from the metrics API.
  • Machine-readable capability coverage and advisor input index.

What it does not collect

  • No kubernetes secret objects or values.
  • No certificate private keys or certificate contents.
  • No unfiltered node or workload journals.
  • No workload environment values or arbitrary annotations.
  • No registry credentials, docker authentication configuration, or raw scan artifacts.
  • No container filesystem contents.
  • No live workload traffic.
  • No automatic upload. You review the bundle before anything leaves your environment.
Sample Report

Anonymized report preview

This example shows how a later, separately authorized diagnostic could organize findings around risk, waste, and the next practical fix. It is not generated by the free intake form.

Finding

CPU requests exceed observed usage

Several services reserve materially more CPU than recent behavior indicates, creating avoidable scheduling pressure.

Impact

Capacity waste and noisy scaling

Over-reservation can force extra nodes online while masking workloads that actually need limits or autoscaling.

Recommendation

Right-size in two stages

Adjust low-risk deployments first, watch eviction and latency signals, then apply the pattern to critical services.

Release flow

Version 0.2.0 ships as a public preview release bundle with a published checksum and explicit dry-run path.

Release status: checksum-published unsigned public preview

SHA-256: bf1cf65eac994d0caf9006ee8d2e4ffb7d327254e1d6b297347fde5323dbfa2e

curl -fsSLO https://tacitsoft.dev/downloads/collectors/k8s-resource-audit/0.2.0/k8s-resource-audit-0.2.0.tar.gz

curl -fsSLO https://tacitsoft.dev/downloads/collectors/k8s-resource-audit/0.2.0/SHA256SUMS

sha256sum -c SHA256SUMS

tar -xzf k8s-resource-audit-0.2.0.tar.gz

./k8s-resource-audit/install.sh --prefix ./out/k8s-resource-audit

Keep the bundle local during assessment

The generated raw bundle stays local. The free assessment starts with your email and problem statement; TacitSoft will state whether a collector or other evidence would improve the next decision. Secure evidence upload is not part of this intake.

Confirm the collector identity, declared files, checksums, sensitivity flags, and redaction coverage locally.

Keep files under raw/ inside your environment; they remain customer-confidential even after inspection.

Do not send the bundle unless a separately authorized evidence-transfer path and handling boundary are provided.

Get a Free Assessment View Release Notes